Skip to content
OpenAdvisories

Vendor

juev

9 known vulnerabilities.

Products

nebula-mesh 9
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.6
    CVE-2026-48058

    nebula-mesh: Session and OIDC state cookies lack the Secure attribute

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to th…

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • Medium 5.5
    CVE-2026-47768

    nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0.3.2.

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • Medium 6.9
    CVE-2026-47725

    nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie p…

    juev nebula-mesh github.com/juev/nebula-mesh Go
  • Medium 6.9
    CVE-2026-48025

    nebula-mesh: Decrypted CA private key persists in heap after signing

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.…

    juev nebula-mesh github.com/juev/nebula-mesh github.com/forgekeep/nebula-mesh Go